Exchange - IMAP Abruf klappt nicht

Betriebssystem: Windows 2019 als Hyper-V VM
Exchange Version: 15.2 (Build 1118.7)
Standard-Testversion

PS C:\Users\Administrator.meine-domain> Get-ServerComponentState -Identity srv-ex01

Server                      Component                  State
------                      ---------                  -----
SRV-EX01.meine-domain ServerWideOffline          Active
SRV-EX01.lmeine-domain.de HubTransport               Active
SRV-EX01.meine-domain.de FrontendTransport          Active
SRV-EX01.meine-domain.de Monitoring                 Active
SRV-EX01.meine-domain.de RecoveryActionsEnabled     Active
SRV-EX01.meine-domain.de AutoDiscoverProxy          Active
SRV-EX01.meine-domain.de ActiveSyncProxy            Active
SRV-EX01.meine-domain.de EcpProxy                   Active
SRV-EX01.meine-domainde EwsProxy                   Active
SRV-EX01.meine-domain ImapProxy                  Active
SRV-EX01.meine-domain.de OabProxy                   Active
SRV-EX01.meine-domain.de OwaProxy                   Active
SRV-EX01.meine-domain.de PopProxy                   Active
SRV-EX01.meine-domain.de PushNotificationsProxy     Active
SRV-EX01.meine-domain.de RpsProxy                   Active
SRV-EX01.meine-domain.de RwsProxy                   Active
SRV-EX01.meine-domain.de RpcProxy                   Active
SRV-EX01.meine-domain.de XropProxy                  Active
SRV-EX01.meine-domain.de HttpProxyAvailabilityGroup Active
SRV-EX01.meine-domain.de ForwardSyncDaemon          Inactive
SRV-EX01.meine-domain.de ProvisioningRps            Inactive
SRV-EX01.meine-domain.de MapiProxy                  Active
SRV-EX01.meine-domain.de EdgeTransport              Active
SRV-EX01meine-domain.de HighAvailability           Active
SRV-EX01meine-domain.de SharedCache                Active
SRV-EX01meine-domain.de MailboxDeliveryProxy       Active
SRV-EX01.meine-domain.de RoutingUpdates             Active
SRV-EX01.meine-domain.de RestProxy                  Active
SRV-EX01.meine-domain.de DefaultProxy               Active
SRV-EX01.meine-domain.de Lsass                      Active
SRV-EX01.meine-domain.de RoutingService             Active
SRV-EX01.meine-domain.de E4EProxy                   Active
SRV-EX01meine-domain.de CafeLAMv2                  Active
SRV-EX01.meine-domain.de LogExportProvider          Active

PS C:\Users\Administrator.meine-domain> Get-ExchangeCertificate | ?{$_.Services} | fl *


EnhancedKeyUsageList : {Serverauthentifizierung (1.3.6.1.5.5.7.3.1), Clientauthentifizierung (1.3.6.1.5.5.7.3.2)}
DnsNameList          : {meine-domain.de}
SendAsTrustedIssuer  : False
AccessRules          : {System.Security.AccessControl.CryptoKeyAccessRule, System.Security.AccessControl.CryptoKeyAccessRule, System.Security.AccessControl.CryptoKeyAccessRule}
CertificateDomains   : {meine-domainde}
CertificateRequest   :
IisServices          : {IIS://SRV-EX01/W3SVC/1}
IsSelfSigned         : False
KeyIdentifier        : 02BC0E27A9B41BC08DCBF4F52726A048597458E2
RootCAType           : ThirdParty
Services             : IMAP, POP, IIS, SMTP
Status               : Valid
SubjectKeyIdentifier : 02BC0E27A9B41BC08DCBF4F52726A048597458E2
PrivateKeyExportable : True
PublicKeySize        : 2048
Identity             : SRV-EX01.meine-domain.de\5A65B7B86728CF866B5599062758B76E4D1A9EC0
ServicesStringForm   : IP.WS..
Archived             : False
Extensions           : {System.Security.Cryptography.Oid, System.Security.Cryptography.Oid, System.Security.Cryptography.Oid, System.Security.Cryptography.Oid...}
FriendlyName         : srv-ex01.meine-domain.de [Certify] - 16.03.2023 17:59:13 to 14.06.2023 18:59:12
IssuerName           : System.Security.Cryptography.X509Certificates.X500DistinguishedName
NotAfter             : 14.06.2023 18:59:12
NotBefore            : 16.03.2023 17:59:13
HasPrivateKey        : True
PrivateKey           : System.Security.Cryptography.RSACryptoServiceProvider
PublicKey            : System.Security.Cryptography.X509Certificates.PublicKey
RawData              : {48, 130, 5, 59...}
SerialNumber         : 049F0D1581B19B83C7B76FC4FC1E39795CDC
SubjectName          : System.Security.Cryptography.X509Certificates.X500DistinguishedName
SignatureAlgorithm   : System.Security.Cryptography.Oid
Thumbprint           : 5A65B7B86728CF866B5599062758B76E4D1A9EC0
Version              : 3
Handle               : 1222554061584
Issuer               : CN=R3, O=Let's Encrypt, C=US  
Subject              : CN=srv-ex01.meine-domain.de

EnhancedKeyUsageList : {Serverauthentifizierung (1.3.6.1.5.5.7.3.1)}
DnsNameList          : {SRV-EX01, SRV-EX01.meine-domain.de}
SendAsTrustedIssuer  : False
AccessRules          : {System.Security.AccessControl.CryptoKeyAccessRule, System.Security.AccessControl.CryptoKeyAccessRule, System.Security.AccessControl.CryptoKeyAccessRule,
                       System.Security.AccessControl.CryptoKeyAccessRule}
CertificateDomains   : {SRV-EX01, SRV-EX01.meine-domain.de}
CertificateRequest   :
IisServices          : {IIS://SRV-EX01/W3SVC/2}
IsSelfSigned         : True
KeyIdentifier        : F7876D1DDEC4EC7C57918BB48D7EF9C3B7C34635
RootCAType           : Registry
Services             : IMAP, POP, IIS
Status               : Valid
SubjectKeyIdentifier :
PrivateKeyExportable : False
PublicKeySize        : 2048
Identity             : SRV-EX01.meine-domain.de\27CF424DF5FA1FD16FD326A38DDCC074719BC042
ServicesStringForm   : IP.W...
Archived             : False
Extensions           : {System.Security.Cryptography.Oid, System.Security.Cryptography.Oid, System.Security.Cryptography.Oid, System.Security.Cryptography.Oid}
FriendlyName         : Microsoft Exchange
IssuerName           : System.Security.Cryptography.X509Certificates.X500DistinguishedName
NotAfter             : 20.12.2027 01:13:00
NotBefore            : 20.12.2022 01:13:00
HasPrivateKey        : True
PrivateKey           : System.Security.Cryptography.RSACryptoServiceProvider
PublicKey            : System.Security.Cryptography.X509Certificates.PublicKey
RawData              : {48, 130, 3, 23...}
SerialNumber         : 73167D1FD3E863AF42F97664DABCC338
SubjectName          : System.Security.Cryptography.X509Certificates.X500DistinguishedName
SignatureAlgorithm   : System.Security.Cryptography.Oid
Thumbprint           : 27CF424DF5FA1FD16FD326A38DDCC074719BC042
Version              : 3
Handle               : 1222554060048
Issuer               : CN=SRV-EX01
Subject              : CN=SRV-EX01

@mx01:~# iptables -t nat -L -vn --line-numbers
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination
1     1253 58384 DNAT       tcp  --  ens192 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:25 to:172.16.0.101:25
2    43424 2213K DNAT       tcp  --  ens192 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443 to:192.168.175.100:443
3      570 24464 DNAT       tcp  --  ens192 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:993 to:192.168.175.100:993
4       41  1828 DNAT       tcp  --  ens192 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:143 to:192.168.175.100:143
5    13253  569K DNAT       tcp  --  ens192 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80 to:192.168.175.100:80
6        0     0 DNAT       tcp  --  ens192 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:465 to:192.168.175.100:465

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination
1    62746 3282K MASQUERADE  all  --  *      *       0.0.0.0/0            0.0.0.0/0